JWE Decryption

Decrypt a JWE online

A compact JWE has five Base64URL segments — header.encrypted_key.iv.ciphertext.tag — and, unlike a JWS, its payload cannot be read without the key. This page decrypts it in your browser: paste the token, supply the private key, shared secret, or password, and the result shows the protected header, the plaintext, and any registered claims.

Nothing is uploaded — decryption runs entirely in your browser. Remember Input and Share are available like everywhere else on this site: Remember Input keeps the token and key in your browser’s local storage, and Share puts them in the link. Both are opt-in and neither sends anything to a server, but a shared link carries whatever is in the fields, so keep test keys and test tokens in here rather than production ones.

How to decrypt

1. Paste the compact JWE. A leading Bearer prefix is accepted and stripped.
2. Leave Algorithm and Encryption on Auto (from header), or pick specific values to pin them. With a pinned value, a token whose header names something else is reported as a mismatch instead of being decrypted.
3. Choose the key type and paste the key:
   • UTF-8, Hex, or Base64 — the shared secret for dir, A*KW, and A*GCMKW, or the password for PBES2-*.
   • Pem Text — the RSA private key for RSA-OAEP*, or the EC / X25519 private key for ECDH-ES*. PKCS#8, PKCS#1, and SEC1 are read, and so is an encrypted PEM with its passphrase.
   • JWK (Set) — a single private JWK (d present), an "kty": "oct" JWK for the symmetric algorithms, or a whole JWK Set. From a set, a kid in the header selects exactly that key; without one, every key that suits the algorithm is tried in order and the result names the one that worked.
4. Decrypt, and read the Header, Plaintext, and Registered Claims sections. A plaintext that is not JSON is shown as text, and one that is not UTF-8 is shown as hex.

Supported algorithms

Algorithm (alg)	Key
RSA-OAEP, RSA-OAEP-256, RSA-OAEP-384, RSA-OAEP-512	RSA private key, 2048 bits or more
ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A256KW	EC private key on P-256, P-384, P-521, or X25519
A128KW, A256KW, A128GCMKW, A256GCMKW	16 or 32-byte shared secret
PBES2-HS256+A128KW, PBES2-HS512+A256KW	Password
dir	Shared secret the size of the content key

Content encryption (enc): A128GCM, A256GCM, A128CBC-HS256, A256CBC-HS512. A "zip": "DEF" header is decompressed, up to 250,000 bytes of plaintext.

The 192-bit variants (A192KW, A192GCMKW, ECDH-ES+A192KW, PBES2-HS384+A192KW, A192GCM, A192CBC-HS384) cannot be pinned, because they need 192-bit AES, which Chrome and Edge leave out of Web Crypto. With Auto, a token that uses one still decrypts in Firefox and Safari; in a Chromium-based browser the page says so instead.

RSA1_5 is not supported: it is vulnerable to padding-oracle attacks and deprecated. The JSON serializations and multiple recipients are out of scope; this page reads the compact form only. Critical (crit) header extensions are not understood, so a token that lists any is rejected as the specification requires.

Pinning the algorithm

alg and enc come from the header, which the sender controls. Auto is convenient here because you choose the key yourself, but a service that decrypts whatever arrives should pin the algorithms it accepts — accepting PBES2 from the outside, for example, lets anyone make the server run PBKDF2 as many times as the token asks. For the same reason this page refuses a p2c above 1,000,000.

Decrypted does not mean trusted

A JWE proves the token was encrypted for this key, not who encrypted it: anyone with the recipient’s public key can produce one. When the sender matters, the plaintext should be a signed JWT ("cty": "JWT"), and that inner token must be checked on JWS Verify. The Registered Claims table shows exp and nbf as observations only.

Related tools

• JWE Encryption to produce a token for a key
• JWS Verify Signature to check a signed token, including one found inside a JWE
• JWT Decoder to inspect a signed token without a key

JWE decryption FAQ

What does “Decryption failed” mean?

The authentication tag did not match. Either the key is not the one the token was encrypted for, or some segment of the token was changed. JWE cannot tell those two apart, by design.

Can I decrypt with a public key?

No. RSA-OAEP and ECDH-ES tokens are encrypted to a public key precisely so that only the holder of the private key can open them.

Why does my PBES2 token fail with a count error?

Its p2c is above 1,000,000, the most iterations this page will run. Tokens made on JWE Encryption always stay within that limit.

My token has three segments.

That is a JWS or signed JWT, not a JWE. Use JWS Verify or JWT Decoder instead.

Is my key sent anywhere?

Not to a server — decryption is entirely local. Remember Input writes the fields to your browser’s local storage, and Share encodes them into a link, so use throwaway keys or leave both switched off.